Massive Data Breach at Background Check Company Exposes Nearly 3 Billion

Why This Alert Is Important

A historic data breach at a background check company has exposed nearly 3 billion records. Privacy and legal professionals must understand the implications to safeguard against unauthorized data exposure.

Overview of the Data Breach

In a significant data breach, Jerico Pictures Inc., operating under the name National Public Data, has exposed confidential data for approximately 2.9 billion individuals. A hacker group known as USDoD infiltrated the company's systems earlier this year, extracting sensitive information. 

Alarmingly, those affected by this breach may not even be aware of their involvement, as National Public Data collected information by scraping non-public sources without consent. One named plaintiff only became aware of the data breach after an identity theft protection service notified him that his information had been leaked on the dark web. The compromised data was subsequently had apparently been posted on a dark web forum in April, with the group demanding $3.5 million to purchase the data. 

This breach ranks among the largest single data breach events in history, comparable to Yahoo’s 2013 breach, highlighting the critical need for robust data security measures in organizations handling sensitive personal information. The RockYou2024 breach exposed almost 10 billion records, but they were actually aggregated password records from numerous prior security incidents.

What It Entailed

The breach involved unauthorized access to a vast database of personal information, including names, addresses, Social Security numbers, and other potentially sensitive data. For organizations and professionals, this incident underscores the dire consequences of inadequate data protection practices. The breach's scale and the method of data collection raise significant ethical and legal concerns.

Data Privacy Tip

For most organizations, data breaches are a question of when, not if. Protecting against data breaches does require taking cybersecurity measures, but it should also involve the development of a solid data breach response plan that includes rapid review of the data breached and issuing notifications to regulators and affected individuals alike. Learn about key components of a breach response review in this infographic.